CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0
Supply Chain and Third Party

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 CPG-6.A: Vendor and Supplier Incident Reporting

Require vendors and suppliers to notify of incidents that may affect the organization.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 115 controls across 66 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

API 1164 · 3 controls

  • API1164-21 TSA Pipeline Security Directive Alignment
  • API1164-22 Configuration management for OT systems
  • API1164-23 Change management procedures

Authorised Economic Operator (AEO) Programmes - Global Standards · 3 controls

  • AEO-2 Demonstrated Compliance with Customs Requirements
  • AEO-4 Financial Viability
  • P2-S1 Partnership

IEC 62443 · 3 controls

  • IEC62443-21 Supply chain risk management for critical components
  • IEC62443-22 Configuration management for OT systems
  • IEC62443-23 Change management procedures

IEEE 1686 · 3 controls

  • IEEE1686-IR-Recovery-Reporting-Exercises-Drills-RECOV IEEE 1686 - Incident Response + Recovery from Failed Update + Reporting to Authorities + Coordination with Sector-Specific Agencies + Exercises and Drills
  • IEEE1686-Section5.5-5.6-5.7-5.8-Firmware-ConfigSW-TimeSync-DataAtRest IEEE 1686 Section 5.5-5.8 - Firmware Quality + Configuration Software Security + Time Synchronisation + Data Protection at Rest + Patch + Malware + Hardening + Vulnerability
  • IEEE1686-SupplyChain-Documentation-Procurement-ComplianceTable-Physical IEEE 1686 Section 6 IED Security Documentation + Supply Chain + Procurement Specification + Appendix A Compliance Table + Physical and Tamper

ISO 20400:2017 - Sustainable Procurement · 3 controls

  • ISO-20400-7.3 Supplier selection
  • ISO-20400-7.4 Contract management and review
  • ISO-20400-7.5 Reviewing and learning

ISO/IEC 27019:2024 · 3 controls

  • ISO27019-22 Configuration management for OT systems
  • ISO27019-23 Change management procedures
  • ISO27019-24 Vulnerability assessment for critical systems

NIST Cybersecurity Framework 2.0 · 3 controls

  • NIST-CSF-GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders
  • NIST-CSF-ID.AM-04 Inventories of services provided by suppliers are maintained
  • NIST-CSF-ID.RA-10 Critical suppliers are assessed prior to acquisition

NIST SP 1800-32 · 3 controls

NIST SP 800-53 Rev 5 · 3 controls

Responsible Minerals Initiative (RMI) - Responsible Minerals Assurance Process · 3 controls

  • RMI-DD-3 Red Flag Review
  • RMI-MS-2 Cobalt Standard
  • RMI-RMAP-2 Risk-Based Audit Approach

Solvency II · 3 controls

  • SII-P2-09 Outsourcing Requirements
  • SII-P2-12 Written Policies
  • SII-P3-06 SFCR Section B: System of Governance

TISAX - Trusted Information Security Assessment Exchange · 3 controls

APRA CPS 230 Operational Risk Management · 2 controls

  • CPS230-27 Identification and Escalation of Incidents and Near Misses
  • CPS230-49 Internal Audit Review of Proposed Critical Operation Outsourcing

GS1 Global Standards - Supply Chain Traceability and Data Security · 2 controls

German Supply Chain Due Diligence Act (LkSG) · 2 controls

ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence · 2 controls

  • A.1 Point-of-Care Testing Additional Requirements
  • ISO-15189-6.8 Externally provided products and services

ISO 28001:2007 Supply Chain Security Management · 2 controls

  • ISO28001-PC-03 Supply Chain Incident Reporting
  • ISO28001-PC-04 Supply Chain Continuity Planning

ISO/IEC 27003:2017 · 2 controls

  • ISO27003-4.2 Understanding the needs and expectations of interested parties
  • ISO27003-8.1 Operational planning and control

Modern Slavery Act 2018 (Australia) · 2 controls

OWASP DevSecOps Maturity Model (DSOMM) · 2 controls

  • DSOMM-3 Build, Deployment, Infrastructure Hardening, and Secrets Management
  • DSOMM-4 Test and Verification - SAST, DAST, IAST, SCA, Penetration Testing

SASB Standards · 2 controls

  • SASB-1 Business Model + Innovation (BMI)
  • SASB-BMI-3 Supply Chain Management

21 CFR Part 211 - Current Good Manufacturing Practice · 1 control

  • CFR211-J-184 Section 211.184 - Component, Drug Product Container, Closure, and Labeling Records

AS9100D - Aerospace Quality Management System · 1 control

  • AS9100D-8.4 Control of Externally Provided Processes, Products, Services

Annex 11 to EU GMP - Computerised Systems · 1 control

  • Clause 3 Suppliers and service providers

Automotive SPICE (ASPICE) v4.1 - Process Assessment Model · 1 control

  • ACQ.4 Supplier Monitoring

BREEAM - Building Research Establishment Environmental Assessment Method · 1 control

  • Mat 03 Responsible Sourcing of Materials

FBI CJIS Security Policy · 1 control

  • CJIS-19 Supply Chain Risk Management

FDA Quality Management System Regulation (QMSR) · 1 control

FedRAMP Rev 5 · 1 control

  • FedRAMP-SupplyChain-SBOM FedRAMP supply chain risk management + SBOM (per EO 14028 + NIST 800-218 SSDF)

French Sapin II Law (Law No. 2016-1691) · 1 control

  • Sapin2-Pillar4-ThirdParty-DueDiligence Pillar 4 - Third-Party Due Diligence (Clients, Suppliers, Intermediaries, M&A)

GAMP 5 - Good Automated Manufacturing Practice · 1 control

  • GAMP5-2nd-Edition-AI-Cloud-Agile-CSA 2nd Edition (2022) - AI/ML, Cloud, Agile, DevOps and Computer Software Assurance (CSA)

GLOBALG.A.P. Integrated Farm Assurance (IFA) Standard v6 · 1 control

  • GGAP-IFA-AllFarmBase-Mgmt-Workers-Env-Trace GLOBALG.A.P. IFA v6 All Farm Base (AF): Management, Workers, Environment, Traceability and Food Safety

IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1) · 1 control

IATF 16949:2016 - Quality Management System for Automotive Production · 1 control

  • IATF16949-Clause8-Supplier-QMS-Development-Externally-Provided IATF 16949 Clause 8 Supplier - Control of Externally Provided Processes + Type and Extent + Supplier QMS Development

ICAO Annex 17 - Aviation Security (AVSEC) · 1 control

  • ICAO-ANX17-Chap4-Cargo-Mail-Catering-Stores-Supplies-RegulatedAgent-KnownConsignor ICAO Annex 17 Chapter 4 - Cargo + Mail + Catering + Stores + Supplies Security + Regulated Agent + Known Consignor + Supply Chain

ICH Q10 - Pharmaceutical Quality System · 1 control

IRM/AIRMIC/ALARM A Risk Management Standard (2002) · 1 control

  • IRM-RiskCategories-Strategic-Financial-Operational-Knowledge-FOIL-External-Internal-DownsideUpside IRM Four Risk Categories - Strategic + Financial + Operational + Knowledge + FOIL Typology + External vs Internal + Downside Threats and Upside Opportunities + Risk Universe

ISO 22316 · 1 control

  • ISO22316-14 Supply chain continuity

ISO 26000:2010 · 1 control

  • ISO-26000-6.6 Fair operating practices

ISO 41001:2018 - Facility Management Systems · 1 control

  • ISO-41001-8.4 Control of outsourced processes and services

ISO 50001:2018 - Energy Management Systems · 1 control

  • ISO-50001-8.3 Procurement

ISO/IEC 23894:2023 · 1 control

  • ISO23894-A.6 AI System Security

ISO/IEC 27010:2015 · 1 control

  • 27010-15.1 Incident Management

ISO/IEC 27011:2024 · 1 control

  • 27011-5.6 Supplier relationships and telecom supply chain

ISO/TS 22317:2021 · 1 control

  • ISO22317-14 Supply chain continuity

ISO/TS 22318:2021 · 1 control

  • ISO22318-14 Supply chain continuity

NERC CIP · 1 control

  • NERCCIP-5 System Security Management + Configuration Change Management and Vulnerability Assessments (CIP-007 + CIP-010)

NIST Privacy Framework · 1 control

  • NISTPF-1 Identify-P - Business Environment, Data Processing Inventory, Ecosystem, and Risk Assessment

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices · 1 control

NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security · 1 control

  • NISTSP82-2 OT Risk Assessment and Threat/Vulnerability Identification

OECD Guidelines for Multinational Enterprises on Responsible Business Conduct (2023 Update) · 1 control

  • OECDMNE-5 Environment, Climate, and Biodiversity

OWASP Top 10 for LLM Applications 2025 · 1 control

  • OWASPLLM-4 Supply Chain and Vector/Embedding Weaknesses (LLM03 + LLM08)

PAS 1192-5:2015 - Security-Minded Approach to BIM and Digital Built Environments · 1 control

  • PASONE-3 Personnel Security, Vetting, Awareness, and Training

PIC/S Guide to Good Manufacturing Practice for Medicinal Products · 1 control

  • PICSGMP-7 Chapter 7: Outsourced Activities and Supplier Management

Protective Security Policy Framework (PSPF) Release 2026 · 1 control

  • PSPF-DIR-001-2024 Direction 001-2024: Foreign Ownership, Control or Influence - Technology Assets

SA8000:2014 - Social Accountability Standard · 1 control

  • SAEIGHT-7 Management System, Worker Engagement, Continuous Improvement

SQF Code Edition 9 - Safe Quality Food · 1 control

  • 2.7.2 Food Fraud Plan

Security of Critical Infrastructure Act 2018 (SOCI) · 1 control

  • SOCI-CIRMP-SUPPLY CIRMP hazard vector: Supply chain

Sigstore - Software Artifact Signing and Verification · 1 control

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 1 control

  • IM8-TPM.4 Supply Chain Risk Management

South Korea ISMS-P · 1 control

  • ISMSP-PI-03 Third-Party Provision and Outsourcing

Space ISAC (Information Sharing and Analysis Center) - Threat Framework · 1 control

  • GT-3 Supply Chain Compromise

UK FCA/PRA Operational Resilience Framework · 1 control

  • UKOPRES-5 Third-Party Risk, Concentration Risk

UK Gambling Commission LCCP and Remote Technical Standards · 1 control

  • UKGAMBLE-4 Resilience and Incident Response

UK Security and Emergency Measures Direction (SEMD) - Water Industry · 1 control

  • SEMD-PS-3 Supply Chain Security

UK Telecommunications (Security) Act 2021 · 1 control

  • UK-TSA-NET-03 Supply Chain Security

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Supply Chain and Third Party

Query this from an agent

The graph holds this control, the 115 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 controls